feat(compute-providers): add MicroVM webhook routing

Author: edersonbrilhante

lambdas/libs/compute-providers/aws/microvm/src/webhook/dynamic-labels.test.ts

@@ -0,0 +1,103 @@
+import { describe, expect, it } from 'vitest';
+
+import type { RunnerMatcherConfig } from '../../../../contracts';
+import { microvmDynamicLabelProvider } from './dynamic-labels';
+
+const imageArn = 'arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner-large';
+const egressConnectorArn = 'arn:aws:lambda:eu-west-1:123456789012:network-connector:github-runner-private-egress';
+
+describe('microvmDynamicLabelProvider', () => {
+  it('accepts supported MicroVM overrides', () => {
+    const queue = microvmQueue();
+    const dynamicLabels = [
+      `ghr-microvm-egress-network-connectors:${egressConnectorArn}`,
+      `ghr-microvm-image-arn:${imageArn}`,
+      'ghr-microvm-image-version:3.0',
+      'ghr-microvm-maximum-duration-in-seconds:7200',
+    ];
+
+    expect(getViolations(queue, dynamicLabels)).toEqual([]);
+  });
+
+  it('rejects unsupported MicroVM resource overrides', () => {
+    expect(getViolations(microvmQueue(), ['ghr-microvm-memory:8192'])).toEqual([
+      {
+        label: 'ghr-microvm-memory:8192',
+        reason: "key 'memory' is not a supported MicroVM override",
+      },
+    ]);
+  });
+
+  it('enforces the AWS dynamic-label policy', () => {
+    const queue = microvmQueue();
+    queue.matcherConfig.awsDynamicLabelsPolicy = {
+      restricted_keys: { 'maximum-duration-in-seconds': { max: 3600 } },
+    };
+
+    expect(getViolations(queue, ['ghr-microvm-maximum-duration-in-seconds:7200'])).toEqual([
+      {
+        label: 'ghr-microvm-maximum-duration-in-seconds:7200',
+        reason: "value '7200' exceeds max '3600'",
+      },
+    ]);
+  });
+
+  it('applies allowed patterns to the complete image ARN', () => {
+    const queue = microvmQueue();
+    queue.matcherConfig.awsDynamicLabelsPolicy = {
+      restricted_keys: {
+        'image-arn': {
+          allowed: ['arn:aws:lambda:eu-west-1:123456789012:microvm-image:approved-*'],
+        },
+      },
+    };
+
+    expect(
+      getViolations(queue, [
+        'ghr-microvm-image-arn:arn:aws:lambda:eu-west-1:123456789012:microvm-image:approved-large',
+      ]),
+    ).toEqual([]);
+    expect(
+      getViolations(queue, ['ghr-microvm-image-arn:arn:aws:lambda:eu-west-1:123456789012:microvm-image:unapproved']),
+    ).toHaveLength(1);
+  });
+
+  it('applies the policy to each egress connector label', () => {
+    const queue = microvmQueue();
+    queue.matcherConfig.awsDynamicLabelsPolicy = {
+      restricted_keys: {
+        'egress-network-connectors': {
+          allowed: ['arn:aws:lambda:eu-west-1:123456789012:network-connector:approved-*'],
+        },
+      },
+    };
+
+    expect(
+      getViolations(queue, [
+        'ghr-microvm-egress-network-connectors:arn:aws:lambda:eu-west-1:123456789012:network-connector:approved-private',
+      ]),
+    ).toEqual([]);
+    expect(
+      getViolations(queue, [
+        'ghr-microvm-egress-network-connectors:arn:aws:lambda:eu-west-1:123456789012:network-connector:unapproved',
+      ]),
+    ).toHaveLength(1);
+  });
+});
+
+function getViolations(queue: RunnerMatcherConfig, labels: string[]) {
+  return microvmDynamicLabelProvider.getViolations({ queue, labels });
+}
+
+function microvmQueue(): RunnerMatcherConfig {
+  return {
+    id: 'microvm',
+    arn: 'arn:aws:sqs:eu-west-1:123456789012:microvm',
+    computeProvider: 'microvm',
+    matcherConfig: {
+      labelMatchers: [['self-hosted', 'linux', 'arm64', 'microvm']],
+      exactMatch: false,
+      enableDynamicLabels: true,
+    },
+  };
+}

lambdas/libs/compute-providers/aws/microvm/src/webhook/dynamic-labels.ts

@@ -0,0 +1,16 @@
+import { violationsAgainstAwsDynamicLabelsPolicy } from '../../../dynamic-labels-policy';
+import type { DynamicLabelProvider } from '../../../../contracts';
+import { MICROVM_DYNAMIC_LABEL_PREFIX, parseMicrovmDynamicLabels } from '../dynamic-labels';
+
+export const microvmDynamicLabelProvider: DynamicLabelProvider = {
+  getViolations: ({ queue, labels }) => {
+    const parsedLabels = parseMicrovmDynamicLabels(labels);
+    const policyViolations = violationsAgainstAwsDynamicLabelsPolicy(
+      labels,
+      queue.matcherConfig.awsDynamicLabelsPolicy,
+      MICROVM_DYNAMIC_LABEL_PREFIX,
+    );
+
+    return [...parsedLabels.violations, ...policyViolations];
+  },
+};

lambdas/libs/compute-providers/aws/microvm/webhook.test.ts

@@ -0,0 +1,27 @@
+import { defineWebhookProviderContractTests } from '../../test/webhook-provider-contract';
+import { provider } from './webhook';
+
+defineWebhookProviderContractTests({
+  provider,
+  acceptedDynamicLabels: ['ghr-microvm-image-version:3.0', 'ghr-microvm-maximum-duration-in-seconds:7200'],
+  rejectingPolicies: [
+    {
+      name: 'blocked keys',
+      apply: (queue) => {
+        queue.matcherConfig.awsDynamicLabelsPolicy = {
+          blocked_keys: ['image-version'],
+        };
+      },
+    },
+    {
+      name: 'restricted keys',
+      apply: (queue) => {
+        queue.matcherConfig.awsDynamicLabelsPolicy = {
+          restricted_keys: {
+            'maximum-duration-in-seconds': { max: 3600 },
+          },
+        };
+      },
+    },
+  ],
+});

lambdas/libs/compute-providers/aws/microvm/webhook.ts

@@ -0,0 +1,16 @@
+import type { ComputeProviderPlugin } from '../../core';
+
+import type { WebhookProviderCapabilities, WebhookProviderModule } from '../../contracts';
+import { microvmDynamicLabelProvider } from './src/webhook/dynamic-labels';
+
+export function createMicrovmWebhookPlugin(): ComputeProviderPlugin<WebhookProviderCapabilities, 'microvm'> {
+  return {
+    type: 'microvm',
+    capabilities: { dynamicLabels: microvmDynamicLabelProvider },
+  };
+}
+
+export const provider = {
+  type: 'microvm',
+  createPlugin: createMicrovmWebhookPlugin,
+} satisfies WebhookProviderModule<'microvm'>;

lambdas/libs/compute-providers/package.json

@@ -12,6 +12,7 @@
     "./aws/ec2/control-plane": "./aws/ec2/control-plane.ts",
     "./aws/ec2/control-plane/runners": "./aws/ec2/src/control-plane/runners.ts",
     "./aws/ec2/control-plane/runner-config": "./aws/ec2/src/control-plane/runner-config.ts",
+    "./aws/microvm/webhook": "./aws/microvm/webhook.ts",
     "./aws/microvm/control-plane": "./aws/microvm/control-plane.ts"
   },
   "type": "module",

lambdas/libs/compute-providers/providers.config.webhook.ts

@@ -1,5 +1,6 @@
 import { provider as ec2 } from './aws/ec2/webhook';
+import { provider as microvm } from './aws/microvm/webhook';
 import type { WebhookProviderModule } from './contracts';
 
 /** Provider plugins included in the webhook bundle. */
-export const enabledWebhookProviders = [ec2] as const satisfies readonly WebhookProviderModule[];
+export const enabledWebhookProviders = [ec2, microvm] as const satisfies readonly WebhookProviderModule[];